The expected audience is mid-tier and small defense suppliers — engineers, IT generalists, project managers — who suddenly have to answer cyber questions to keep contracts moving. We work through threat scenarios drawn from public material (Five Eyes advisories, CCCS bulletins, recent incidents at Canadian and US suppliers), then move into the control families that get audited: access control, configuration management, incident response, and supply chain. Roughly a third of the contact hours are hands-on labs — phishing analysis, log triage, control gap mapping. No offensive content; this is defender-side, by design.